6b180467ccb9cfa7d7cb952ff362215b28c8698abde0f475a3bafbcf9197b414

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 20:06

Target

03862957bbf2565b4195fa7736949bb7_JaffaCakes118.exe
Size

368KB
MD5

03862957bbf2565b4195fa7736949bb7
SHA1

8450b15d387b034031ae7a80ffb56855b50815d7
SHA256

6b180467ccb9cfa7d7cb952ff362215b28c8698abde0f475a3bafbcf9197b414
SHA512

e3086937c996a6039e352de28b4e9d34a0870c2d3644d6c26e159bef32a7228536af275fd303b359ab1a4c05817879f7cbfb9d2bab07319215b8c7ab235987bd
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3d:R041m5Q/0N4L9xYus1NSD2Cg3d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	2236	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2488	2236	03862957bbf2565b4195fa7736949bb7_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2488	2236	03862957bbf2565b4195fa7736949bb7_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2488	2236	03862957bbf2565b4195fa7736949bb7_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2488	2236	03862957bbf2565b4195fa7736949bb7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\03862957bbf2565b4195fa7736949bb7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03862957bbf2565b4195fa7736949bb7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 116
  2⤵
  - Program crash
  PID:2488

memory/2236-0-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Filesize
384KB

Download